[310] in Privacy_Forum
[ PRIVACY Forum ] Bulletin: Home Addresses for Unlisted Numbers
daemon@ATHENA.MIT.EDU (privacy@vortex.com)
Thu Dec 13 17:02:20 2007
Message-Id: <200712132120.lBDLK6a6000425@chrome.vortex.com>
To: privacy-list@vortex.com
Date: Thu, 13 Dec 2007 13:20:06 -0800
From: privacy@vortex.com
Reply-To: PRIVACY Forum Digest mailing list <privacy@vortex.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Errors-To: privacy-bounces+privacy-forum=mit.edu@vortex.com
Content-Transfer-Encoding: 8bit
Bulletin: Home Addresses for Unlisted Numbers Exposed on Web -- For Free!
http://lauren.vortex.com/archive/000341.html
Greetings. This message is basically a heads-up warning. I have
discovered a serious and easily exploited security flaw in the
operations of a major commercial Web services provider, which
exposes the street address and/or billing address information for
(apparently) a very large proportion of U.S. landline phone numbers,
*even if those numbers are unlisted*.
While such "reverse lookups" for *listed* numbers are common,
unlisted number information is supposedly held to the highest
security standards of telephone company customer premises
information -- though third party mining of this data has been of
increasing concern. How this unlisted number data has found its way
into this publicly accessible database is a very interesting
question indeed.
Most people must pay extra for unlisted numbers, and often have them
for security reasons. With numbers so widely exposed by calling
number identification systems (CNID) and in the course of routine
business transactions, the easy availability of the addresses
associated with these unlisted numbers is a very serious matter.
I am still attempting to reach responsible parties at the firm
involved. I will not expose the technique for obtaining these
addresses here and now for obvious reasons, but I will consider
providing more details upon request to bona fide security experts
and media -- under appropriate confidentiality guidelines to protect
this data until the breach has been closed.
More later.
--Lauren--
Lauren Weinstein
lauren@vortex.com or lauren@pfir.org
Tel: +1 (818) 225-2800
http://www.pfir.org/lauren
Co-Founder, PFIR
- People For Internet Responsibility - http://www.pfir.org
Co-Founder, NNSquad
- Network Neutrality Squad - http://www.nnsquad.org
Founder, PRIVACY Forum - http://www.vortex.com
Member, ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
_______________________________________________
privacy mailing list
http://lists.vortex.com/mailman/listinfo/privacy
